CVE-2023-27826

Deeper analysis

SeowonIntech SWC 5100W WIMAX Bootloader versions 1.18.19.0 with hardware 0.0.7.0 and firmware 1.11.0.1 or 1.9.9.4 contain an OS command injection vulnerability tracked as CVE-2023-27826. The flaw stems from improper handling within the doSystem() function and is classified under CWE-78, enabling unauthenticated or low-privileged remote attackers to execute arbitrary operating system commands. It carries a CVSS 3.1 score of 8.8 reflecting network attack vector, low complexity, and full confidentiality, integrity, and availability impact.

An attacker with network access and valid low-privileged credentials can supply crafted input that abuses doSystem() to run commands as root, resulting in complete system takeover. Public exploit code has been posted to Exploit-DB and Pastebin, confirming the issue is reproducible against the listed bootloader and firmware revisions.

The EPSS score for this CVE rose from a low baseline to a recorded peak of 0.2351 with a current value of 0.1730, indicating measurable post-disclosure exploitation interest. No vendor advisory or patch information appears in the referenced materials, which consist primarily of device manuals and exploit artifacts.